Information Disclosure Vulnerability in VanBlog Product by Mereithhh

CVE-2026-125376

What is CVE-2026-125376?

The VanBlog product up to version 0.54.0 is affected by an information disclosure vulnerability that permits unauthenticated attackers to access private and hidden articles. This exposure occurs through the insecure handling of requests at the POST /api/public/article/:id endpoint. Attackers can exploit this flaw by submitting arbitrary non-empty passwords for protected articles that lack proper password validation, or by requesting hidden articles, as the function getByIdWithPassword does not adequately verify the hidden status. The result is unauthorized access to the full content of sensitive articles.

References